This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 9c307c8f4f421f5f9652334f29d2ab6cf5739b50 Author: Andrea Cosentino <[email protected]> AuthorDate: Thu Oct 22 10:58:19 2026 +0200 Align publication date of the 4.22.2 advisories to 2026-10-22 Set the date front-matter field of the seven advisories staged for the 4.22.2 release to the publication date and re-sign each signed text so that the signature covers the updated content. Co-Authored-By: Claude Opus 5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-101259.md | 2 +- content/security/CVE-2026-101259.txt.asc | 18 +++++++++--------- content/security/CVE-2026-90885.md | 2 +- content/security/CVE-2026-90885.txt.asc | 18 +++++++++--------- content/security/CVE-2026-94386.md | 2 +- content/security/CVE-2026-94386.txt.asc | 18 +++++++++--------- content/security/CVE-2026-95628.md | 2 +- content/security/CVE-2026-95628.txt.asc | 18 +++++++++--------- content/security/CVE-2026-95629.md | 2 +- content/security/CVE-2026-95629.txt.asc | 18 +++++++++--------- content/security/CVE-2026-95663.md | 2 +- content/security/CVE-2026-95663.txt.asc | 18 +++++++++--------- content/security/CVE-2026-95664.md | 2 +- content/security/CVE-2026-95664.txt.asc | 18 +++++++++--------- 14 files changed, 70 insertions(+), 70 deletions(-) diff --git a/content/security/CVE-2026-101259.md b/content/security/CVE-2026-101259.md index 3e557a40..55d33b89 100644 --- a/content/security/CVE-2026-101259.md +++ b/content/security/CVE-2026-101259.md @@ -1,6 +1,6 @@ --- title: "Apache Camel Security Advisory - CVE-2026-101259" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-101259.html draft: false type: security-advisory diff --git a/content/security/CVE-2026-101259.txt.asc b/content/security/CVE-2026-101259.txt.asc index b766058b..74299c1a 100644 --- a/content/security/CVE-2026-101259.txt.asc +++ b/content/security/CVE-2026-101259.txt.asc @@ -3,7 +3,7 @@ Hash: SHA512 - --- title: "Apache Camel Security Advisory - CVE-2026-101259" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-101259.html draft: false type: security-advisory @@ -28,12 +28,12 @@ The consumer has returned the message of such an exception to the client since c This is the CoAP member of the unmuted-consumer-exception family published as CVE-2026-84180 (camel-knative), CVE-2026-85246 (camel-mina), CVE-2026-85257 (camel-cxf) and CVE-2026-85315 (camel-grpc), and the new option follows the same muteException convention. Unlike those consumers, the CoAP consumer did not return the exception of a failing route, only one raised while it built the response after the route had completed. It is classified as CWE-209 (Generation of Error Message Containi [...] -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ -QQAUegf+OmGMt7gRzwR2Ye7H9iQ9dkQ8n7rafb59GoF4yACu6UcvSfYkQnbjNGW5 -/kIdIEHvpukcRvd/1CEPJAunZlO11KqIDG2905rIBLm+QXaynOaL/rYMc+g23D5+ -ibK1jglvtPnZyA9GKAJMLcYROgDTxgYB8ozX7erZC5GjFGBxxSuI/RwIBhHJZTtg -TKVX/jbz1LiVN0zB4EzeY3vJYSJz5OgeOG7H4BlBFckJFLaxUnOVTSEHLsOdADy1 -RiGcsuD6JFfdbV1HIT/cLq0VPavRGESkCX1+ebNB/MGO5/T+9x+56mG04ylWMeBw -5R4gjSynJR8X1HHnniZaa2ubMSp4OA== -=/IbH +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrZ0AgACgkQ406fOAL/ +QQC2MggAwfeV6vZFf6ldx0EoamJJL6HuVNxNZoK8asg7DY5S/Xbs3uficMl9HNOa +toYSd0O/PodWHqM9oYRCqtArL4W/T5yibw9J8zgOVj7go6utY2VteUqqBhZ+n8zF +HCuQJIHEIwlOqJ7P1AIjFQoeoTWsxyYsrml57PoGo7rocvMdDIvNqjGzlDviyYyc +eIWedObryCrhZcGlNXaS252eKib+F/JuXlPkNzkYzUwWjvPacw5A8aVxEDkt3MFI +wAxAynmb0RWDYw8NcN+kSuygz0Ddab/WGffwf0unKfUucWcovyRo3jQTV4s4Kfk1 +Xwil7K1KiMdWexNkz0Fp3MXykwsU+Q== +=KiBt -----END PGP SIGNATURE----- diff --git a/content/security/CVE-2026-90885.md b/content/security/CVE-2026-90885.md index 65ca531b..eb46ee4c 100644 --- a/content/security/CVE-2026-90885.md +++ b/content/security/CVE-2026-90885.md @@ -1,6 +1,6 @@ --- title: "Apache Camel Security Advisory - CVE-2026-90885" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-90885.html draft: false type: security-advisory diff --git a/content/security/CVE-2026-90885.txt.asc b/content/security/CVE-2026-90885.txt.asc index bf4c22ea..b48e51eb 100644 --- a/content/security/CVE-2026-90885.txt.asc +++ b/content/security/CVE-2026-90885.txt.asc @@ -3,7 +3,7 @@ Hash: SHA512 - --- title: "Apache Camel Security Advisory - CVE-2026-90885" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-90885.html draft: false type: security-advisory @@ -28,12 +28,12 @@ The code path predates Apache Camel 4.0 and was already present in the 2.x and 3 This issue is distinct from CVE-2026-85250, which concerned the documentType=InputSource option of camel-xpath and was fixed in 4.18.5, 4.22.1 and 4.23.0. Both concerned an input path that bypassed the parser hardening applied by default, but they are in different components and the fix for one does not cover the other; in particular, 4.22.1 resolves CVE-2026-85250 but not this issue. It is classified as CWE-611 (Improper Restriction of XML External Entity Reference). -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrWCw0ACgkQ406fOAL/ -QQDSCgf+P42OTo1YfJ/L7z+StZYYIPeaKvBNTI56kbcggjiVgm9G1gTR8NgbiSs3 -K8V5Vv1l+Q9MECgLZt6kpjMXK/3kukJrfRoJDMiMzVRqK7QI4WzbJv8tZEO4sIuu -D6wWz/0vCg65CHogKL5WCx7Zk26OjzncTixdwU36Uj1bIIJijtbtbpWlRI574N3Z -SoA6bHz8FpHh7B/GZLFuYNE0SSdm+LbN/jRRMqz4A1ntEShk5HuxZJ4Jwxg+tHz8 -iRT9jfFhPavpP3d4pEbQt6OjuG/qtC81DGabOYichZyu4If/YJ4SjtFj5J4H/nHp -ctTMTG2FPlpvU/Ahjl32VFd2Nko1Cw== -=f9WN +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrZ0AcACgkQ406fOAL/ +QQA9jAf/VUKzuO8cO2uaxKGZLMGgBe3M4t7si/JTutq+dRJR7RgtJdp6+EHci1ex +wTn0/AFWByLovWh8gBZRtwwIEteqTujXelvY1PGQDQFciFmRf04l2fdE3WpPtyvK +yTS15/5WmAB3/zcxufi2Fz0IZbH1gpVmSSQrBqnQ0csSdXcRPbRlpCnQToDt0NCA +WGc6aCNq+0E8A3qoaRs+TUjzyB8kTyacEn5syMB3vkAY1Nl8Uab0JEBzziNGTgST +A2oV8FCTWPDt03mLn+bUYmNa2WsZUyQih9HC3LMG6f8dvVBZ5TCF3Yx81YBZU/oX +yGZp9Tsv/02Wd5d9BzPcaP2W/AXG2A== +=aTCO -----END PGP SIGNATURE----- diff --git a/content/security/CVE-2026-94386.md b/content/security/CVE-2026-94386.md index b2708fba..b4dc8063 100644 --- a/content/security/CVE-2026-94386.md +++ b/content/security/CVE-2026-94386.md @@ -1,6 +1,6 @@ --- title: "Apache Camel Security Advisory - CVE-2026-94386" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-94386.html draft: false type: security-advisory diff --git a/content/security/CVE-2026-94386.txt.asc b/content/security/CVE-2026-94386.txt.asc index 9389761f..caffdbb6 100644 --- a/content/security/CVE-2026-94386.txt.asc +++ b/content/security/CVE-2026-94386.txt.asc @@ -3,7 +3,7 @@ Hash: SHA512 - --- title: "Apache Camel Security Advisory - CVE-2026-94386" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-94386.html draft: false type: security-advisory @@ -28,12 +28,12 @@ The client credentials token resolver and its cache were added in 4.19.0 by http This is the same class of defect as CVE-2026-85317, in which the OAuth2 client token cache of camel-http was keyed on fewer fields than shape the token. The two caches are separate code and that fix did not touch camel-oauth; here, unlike in camel-http, token caching is enabled by default, and the key also left out the client secret. The issue is also distinct from CVE-2026-80312 and CVE-2026-84178, which concerned the inbound processors of camel-oauth: 4.22.1, which fixes those two, is [...] -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ -QQBIbAf+Ic5m/vClqHq33G8tmBz6t47ngXITq+B1ZUiBjMICbsCe6Mx/+0Zj3rlR -VAgbTidVH4PoLm0DUoUkvy2yXChvgSxfqN+3AB/EoOaJSNyTE8ncDesDWA93PaVW -rpoSk7Q7sznW10FRwGIGxLc51gFbLfnlN/wgvWRDXrDiBsuishFDuWT4imlzMmMv -NhQyEx4Ldz2HAlBVXJySB7cywIFE/vQe/FVMp5ERb8tcpYu5ArLndk48S2aGP9gK -h+pH+SKDPqp5z2jkEmugjBk4cJ5bJul/x2wbWQw+Di7MsylzJnPgMbembghDjdsm -9SiJGq56h2K4rKf9xvpMXwb8Jy6qLg== -=G/r9 +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrZ0AcACgkQ406fOAL/ +QQB5ggf+Ie2g/OEwSBtc2uVgoC6HmEiThNJLhXdLHy3/KdT0YvAs9wkLEdlbZDMJ +0XrdR+DhGAvfVlki+4SfhG2XOv8h95eW1HB0w1CvSo77dxKs/Z0WrkuaOR3scCcm +mM3c0TACZhNPXpOk27JZ5nq+dWPBB35F+AelFj1C7U0vqo65RhcF3bgxDumBSp4/ +zEpAvoWAIUFxhpQQykdxJ48RMOAGt0uPTiZh8Vllnt9/vkHMB0C94wUhu6kH8HeL +NvKlvmcPKDptUadDoVYDPtBJz1kiyuoKKTqU7glSMOliWk9guU6f0NsCtC0YsuQY +soKfpzVk+Ox5S5SrVR+xSBnt+CP/RQ== +=k4tr -----END PGP SIGNATURE----- diff --git a/content/security/CVE-2026-95628.md b/content/security/CVE-2026-95628.md index 3add39c3..f48d8d4b 100644 --- a/content/security/CVE-2026-95628.md +++ b/content/security/CVE-2026-95628.md @@ -1,6 +1,6 @@ --- title: "Apache Camel Security Advisory - CVE-2026-95628" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95628.html draft: false type: security-advisory diff --git a/content/security/CVE-2026-95628.txt.asc b/content/security/CVE-2026-95628.txt.asc index 854f473b..37e1feea 100644 --- a/content/security/CVE-2026-95628.txt.asc +++ b/content/security/CVE-2026-95628.txt.asc @@ -3,7 +3,7 @@ Hash: SHA512 - --- title: "Apache Camel Security Advisory - CVE-2026-95628" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95628.html draft: false type: security-advisory @@ -28,12 +28,12 @@ Custom-argument values have never been checked for absolute paths. From its intr This advisory is an incomplete-fix follow-on to CVE-2026-40047 (CAMEL-23212), whose fix introduced validatePathSafety to keep path-like custom-argument values from leaving the intended directory but only checked for relative traversal, so deployments that upgraded to 4.18.3 or 4.19.0 in response to that advisory remained exposed to absolute values. The CamelDoclingOutputFilePath header, which the custom-argument validation names as the way to choose the output directory, is not a custom [...] -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ -QQD2nQf+NaHu7r9UZG57bytiGoSbJg0xzHFZ5Ri9Bdb2B+PNY5etU0wCroEOKb8p -1tunDFsLpGaqWM20KlvxWSHZczX+kVUy0pl72Haol07etoSZNZ+R8eWn6sJdYYeH -932PdGomlk86Re7dDykErAUVSCOcGrDhC16c8CLmmxi1Zx9O4rxZr9MnMSys3INb -XSULGx9Ahg/HQss2fiXvbWNy6xKbvu34aS1lU5b4/nm4pxYv8EwFJuS9uiOWYTUF -WPbMC8jOr2Ud7SJOnTAoc75tzKrkecJHm1v8u0j5EiFh0KxkEhy+3RNiAZgZjdNO -BjxrM5XNZo3pJxcR7uUBvNEx+H8FRA== -=BNY0 +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrZ0AcACgkQ406fOAL/ +QQA7Qgf8Cg+HSz5vAMJTxXohByrHDf2/AeuvWaJtNmpekSMo8pKBv3V2rTpUJpT4 +T07MhigXOJRUl3AxASo0MRZSXYQUMtpcJdDNAmWV/F7G6xGD3rDQRU4iXKIYaMJ4 +yf8wa9nsDmRX2S4ACTZudxajgqb5ReKIdPS4OSVR6q6hWjz+rTOB4vlUz815hMF/ +BkiT2fP++gFY10pSgFTQZxWHW+UK/MmoVWwo2hrp8tk3x0SUoGga4Akqiz4aWfTE +UR9PbZHXMHEhGi4y5k/W7m36u+2pAHBK+GQjd72bMN4Onv7w7Ttmontt66HS8Pzl +rI36HKLgnM7AiYw9tJpu3yBucMENbg== +=VEH9 -----END PGP SIGNATURE----- diff --git a/content/security/CVE-2026-95629.md b/content/security/CVE-2026-95629.md index 4ca84bcb..18b26ba8 100644 --- a/content/security/CVE-2026-95629.md +++ b/content/security/CVE-2026-95629.md @@ -1,6 +1,6 @@ --- title: "Apache Camel Security Advisory - CVE-2026-95629" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95629.html draft: false type: security-advisory diff --git a/content/security/CVE-2026-95629.txt.asc b/content/security/CVE-2026-95629.txt.asc index 5fc81b76..b3e17e8f 100644 --- a/content/security/CVE-2026-95629.txt.asc +++ b/content/security/CVE-2026-95629.txt.asc @@ -3,7 +3,7 @@ Hash: SHA512 - --- title: "Apache Camel Security Advisory - CVE-2026-95629" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95629.html draft: false type: security-advisory @@ -28,12 +28,12 @@ The header has reached the docling output flag unchanged since camel-docling was This issue is related to CVE-2026-40047, which concerned insufficient validation of the CamelDoclingCustomArguments header in the same component: the validation that fix put in place refuses the output flags among the custom arguments and names this header as the way to choose the output directory, but the header itself was left unchecked. The outputBaseDirectory option is the output-side counterpart of the inputBaseDirectory option introduced by the fix for CVE-2026-78163, which concern [...] -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ -QQBWuggAl/9gyftY4P5TDrfkpTd+CdiKQFc/lmVFEdqZvtAJicsjRpgOIl/Vub2f -C1PH1/IlUH/p2pd3QWzwjnp4LpHQdgRYWvC7KYFUAV0uBKRx2eduv3/0OZEN2fII -TuWgQsnAkFwiYYGZdZZVQtGaByXunWhYmxjITtW4gYvDe9nEv/aT3tN7JtTLaIGh -ePJ6JC1zP/NRQnTPceflerSkr42ga40Vjn1SEB90d8qM7lHDNqR+snYhkWggmftS -623iYWlaOgguw0DB2sGXNU5ShT19JSPYO286MEETmBp7hsDgzx99iaeRQB8XIntA -DdlSeOAWyVAfzLD33S4bTwlsYSU5PA== -=zcFr +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrZ0AcACgkQ406fOAL/ +QQCXeQgAmCVTUUzhapSES+r+9jMLmj+Cfrw07yJ5tSBUH+t+16IujBklWayXC3gs +4FgiKxjdVHbi4balB5O+w7fvW8GAA1KzBnr1TrXp/+DIIEczieiAYWyR0N1jol/B +f9DqsCOqbS2FiJWg2sLSkqK4qpJyRJ/PLZov4vDbipm1u3SAHfIG001Z/HlkbHMD +UgRW3uC6h8dNawnLsmPGUGzPFzIO1i/G6Ilzjx6h5KbGyMBWhZUSz0Qf2N4rcV+G +5xCzHzgLFYB/SK//savfRXte5B/YMesevZVJHgpMN0ZHX4LYOi8xCTN4reqkoooa +v6EG8a1/u79U5zLwUGWPYgzGFQKRsg== +=3JvH -----END PGP SIGNATURE----- diff --git a/content/security/CVE-2026-95663.md b/content/security/CVE-2026-95663.md index 5a0d0c88..10ac41cb 100644 --- a/content/security/CVE-2026-95663.md +++ b/content/security/CVE-2026-95663.md @@ -1,6 +1,6 @@ --- title: "Apache Camel Security Advisory - CVE-2026-95663" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95663.html draft: false type: security-advisory diff --git a/content/security/CVE-2026-95663.txt.asc b/content/security/CVE-2026-95663.txt.asc index 0553c5ac..6a396502 100644 --- a/content/security/CVE-2026-95663.txt.asc +++ b/content/security/CVE-2026-95663.txt.asc @@ -3,7 +3,7 @@ Hash: SHA512 - --- title: "Apache Camel Security Advisory - CVE-2026-95663" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95663.html draft: false type: security-advisory @@ -28,12 +28,12 @@ Token introspection was added to camel-keycloak in 4.16.0 together with the resu This issue is distinct from CVE-2026-46455, which concerned the local JWT verification path: the token verifier there was built without its IS_ACTIVE check, so the validity window of a token was not enforced at all, and the fix in 4.18.3 and 4.21.0 added that check. When useTokenIntrospection is enabled the local verification path is not used and expiry is decided from the introspection response instead, so that fix did not reach the gap described here, which affects releases with and wi [...] -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ -QQCuYwf/STBY7fk29KzLiyKZxG1/ibstTESM1A1PUpvqERTj28n2QXZt6aplYoWD -59wtBBnAneATbYxxrX0gGTeck7CNPofWdk519IG2teC2YJLCneSWnsI8avulfkHC -e46HVskwUyGcQUOIekqESplIio5e5oOgjGpZDOyytvRD9GhiB4O+Y1w0oJt/eEe9 -xq7ZMuTacDmObU/DJ1IL539g8efZ2Go18qoTKK9LyxKjwX78KjkvqHFL+baSkAe2 -OrDSOvYOino+O8VzJEzvHG/lJX08WTnkJdTiG+/Kwr9XjX3/Gdy3uJp+Zck5pFlE -aXTCeQPcwEInWGk8sLn/t/Mk22YldQ== -=rM6M +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrZ0AcACgkQ406fOAL/ +QQAapgf/eByNE2S6b5C0oYNnRCJ/D+B3ri1ZzbghHI7YCcNQBltgVAv6PcClC8Z1 +is2BZi9y7iD6fv0MGJT3BJEr0Y/tHM/NVLToRof0D1o9VHF+5JFz1vs3gBsZ/vzN +nlyxu1+3Iapvt5ClXNLpujzpH5jz8XiqppvMBaLa4suY7oEcRYEYQ8l33+f3c6WE +IaYEdd8FOipygPpkadpg2HDLudobyeJ4cv2t2qDHuLqtO4BVLKynT1OrzwnxZGXg +8OWaS/fXXBH3T/j5LZtJC9QulfnO2SGFZreVMSpV0dA/TMn9YG80hc3k662P1Kb8 +hl7KFKAql4qqHTqozb7Wqs0s6eoeOA== +=KBAi -----END PGP SIGNATURE----- diff --git a/content/security/CVE-2026-95664.md b/content/security/CVE-2026-95664.md index af01e39d..aa84f43f 100644 --- a/content/security/CVE-2026-95664.md +++ b/content/security/CVE-2026-95664.md @@ -1,6 +1,6 @@ --- title: "Apache Camel Security Advisory - CVE-2026-95664" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95664.html draft: false type: security-advisory diff --git a/content/security/CVE-2026-95664.txt.asc b/content/security/CVE-2026-95664.txt.asc index 44d3ac5a..8ad852e8 100644 --- a/content/security/CVE-2026-95664.txt.asc +++ b/content/security/CVE-2026-95664.txt.asc @@ -3,7 +3,7 @@ Hash: SHA512 - --- title: "Apache Camel Security Advisory - CVE-2026-95664" -date: 2026-10-19T10:00:00+02:00 +date: 2026-10-22T10:00:00+02:00 url: /security/CVE-2026-95664.html draft: false type: security-advisory @@ -28,12 +28,12 @@ The evaluation has been present since 4.8.0, when https://issues.apache.org/jira This issue belongs to the same family as CVE-2026-78164, where the HTTP producers resolved property placeholders in message-supplied URI override headers, and CVE-2026-83531, where the dynamic-router-control endpoint compiled predicate expressions supplied by control messages: in each case the framework evaluated a value that arrived with the message instead of treating it as data. It is distinct from the Camel header-injection advisories such as CVE-2025-27636, which concern consumers t [...] -----BEGIN PGP SIGNATURE----- -iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ -QQChZAf/bxgTVVooyQkQoSD1dnfWT6+grYTeGxT0BLRUaVOYnqRL67aeHJ1k/t6q -cqVP4k/bFtQOP9TdMLxMxciwD1cyi4Ba7IKqra+VA2gSt46DFb7Qr4tvyxOVd9Lr -wO2BMRmQwuduACGif1gPjlRQxK5acl+gyP3jVm/cqNRB5qVEnw/2FKOFb+ea1tDY -oYydamxE8lJFvnxvogEKjdoqzfziQ+Sl7aN2vH6pLO/eBdWbxdcHCGERfVLWPbVh -1wtikbmgeHrtKW212kHevKt2+tzEgvyNAtihK8uUJxpCMpY1YIXEFlN0gMnZK0cQ -IZvWBYUuk9DCo2B/0EmdBBBv9qlCuA== -=ST/7 +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrZ0AcACgkQ406fOAL/ +QQA2XwgAoznAGJSzNHCSkCCBwERGBEj4RY+NPvOUhKwIv7/p0VadB0zaVZVNr0o2 +iZr2kvQG+nqQlhAfoSV3CBTKRTQMlHuNUtz7QXic09JE7hShTuhJrZw6yxoGodiX +sjO9pOKpDhj4L2ItraZfaWIU1VbvqI3qhrEkX/QZ5OlwbGdsuwEd2LqVeftv+ZqR +KrJz2XYjsDGbFjtvlY9TocFM2iel7lL9bKBlX0z3+sZAnM1UBK0XGKYerABbOjM8 +5yEANYO0UGuY9EerPKfS5we6LYAVvbw8A7W42Al1j5Hw3XTeLAkWDmTi7Bg+mUoB +CjoRrKOmSYlatTlIpMVFx2fmZLtodA== +=yt+O -----END PGP SIGNATURE-----
